CVE-2026-32191CWE-78

Microsoft Bing Images Remote Code Execution Vulnerability

Critical · published March 19, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
65.2
In the wild
Unconfirmed
What it is

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.01094 · 65.2th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-03-19T21:06Z
EPSS history
Timeline
  • 19 MAR 21:06Z
    Microsoft Bing Images Remote Code Execution Vulnerability
    cvelistv5